@strapi/plugin-users-permissions 4.0.0-next.7 → 4.0.1

package/server/services/providers.js

@@ -6,15 +6,18 @@
 
 // Public node modules.
 const _ = require('lodash');
-const request = require('request');
+const jwt = require('jsonwebtoken');
+const urlJoin = require('url-join');
 
-// Purest strategies.
-const purest = require('purest')({ request });
-const purestConfig = require('@purest/providers');
 const { getAbsoluteServerUrl } = require('@strapi/utils');
-const jwt = require('jsonwebtoken');
 
 module.exports = ({ strapi }) => {
+  // lazy load heavy dependencies
+  const request = require('request');
+  // Purest strategies.
+  const purest = require('purest')({ request });
+  const purestConfig = require('@purest/providers');
+
   /**
    * Helper to get profiles
    *
@@ -25,13 +28,8 @@ module.exports = ({ strapi }) => {
   const getProfile = async (provider, query, callback) => {
     const access_token = query.access_token || query.code || query.oauth_token;
 
-    const grant = await strapi
-      .store({
-        environment: '',
-        type: 'plugin',
-        name: 'users-permissions',
-        key: 'grant',
-      })
+    const providers = await strapi
+      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })
       .get();
 
     switch (provider) {
@@ -66,7 +64,7 @@ module.exports = ({ strapi }) => {
               // Combine username and discriminator because discord username is not unique
               var username = `${body.username}#${body.discriminator}`;
               callback(null, {
-                username: username,
+                username,
                 email: body.email,
               });
             }
@@ -203,8 +201,8 @@ module.exports = ({ strapi }) => {
         const twitter = purest({
           provider: 'twitter',
           config: purestConfig,
-          key: grant.twitter.key,
-          secret: grant.twitter.secret,
+          key: providers.twitter.key,
+          secret: providers.twitter.secret,
         });
 
         twitter
@@ -227,8 +225,8 @@ module.exports = ({ strapi }) => {
       case 'instagram': {
         const instagram = purest({
           provider: 'instagram',
-          key: grant.instagram.key,
-          secret: grant.instagram.secret,
+          key: providers.instagram.key,
+          secret: providers.instagram.secret,
           config: purestConfig,
         });
 
@@ -300,7 +298,7 @@ module.exports = ({ strapi }) => {
 
         twitch
           .get('users')
-          .auth(access_token, grant.twitch.key)
+          .auth(access_token, providers.twitch.key)
           .request((err, res, body) => {
             if (err) {
               callback(err);
@@ -405,7 +403,7 @@ module.exports = ({ strapi }) => {
       }
       case 'auth0': {
         const purestAuth0Conf = {};
-        purestAuth0Conf[`https://${grant.auth0.subdomain}.auth0.com`] = {
+        purestAuth0Conf[`https://${providers.auth0.subdomain}.auth0.com`] = {
           __domain: {
             auth: {
               auth: { bearer: '[0]' },
@@ -444,7 +442,7 @@ module.exports = ({ strapi }) => {
         break;
       }
       case 'cas': {
-        const provider_url = 'https://' + _.get(grant['cas'], 'subdomain');
+        const provider_url = 'https://' + _.get(providers.cas, 'subdomain');
         const cas = purest({
           provider: 'cas',
           config: {
@@ -522,23 +520,20 @@ module.exports = ({ strapi }) => {
           return reject([null, err]);
         }
 
+        const email = _.toLower(profile.email);
+
         // We need at least the mail.
-        if (!profile.email) {
+        if (!email) {
           return reject([null, { message: 'Email was not available.' }]);
         }
 
         try {
           const users = await strapi.query('plugin::users-permissions.user').findMany({
-            where: { email: profile.email },
+            where: { email },
           });
 
           const advanced = await strapi
-            .store({
-              environment: '',
-              type: 'plugin',
-              name: 'users-permissions',
-              key: 'advanced',
-            })
+            .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })
             .get();
 
           const user = _.find(users, { provider });
@@ -572,11 +567,13 @@ module.exports = ({ strapi }) => {
             .findOne({ where: { type: advanced.default_role } });
 
           // Create the new user.
-          const params = _.assign(profile, {
-            provider: provider,
+          const params = {
+            ...profile,
+            email, // overwrite with lowercased email
+            provider,
             role: defaultRole.id,
             confirmed: true,
-          });
+          };
 
           const createdUser = await strapi
             .query('plugin::users-permissions.user')
@@ -590,8 +587,10 @@ module.exports = ({ strapi }) => {
     });
   };
 
-  const buildRedirectUri = (provider = '') =>
-    `${getAbsoluteServerUrl(strapi.config)}/connect/${provider}/callback`;
+  const buildRedirectUri = (provider = '') => {
+    const apiPrefix = strapi.config.get('api.rest.prefix');
+    return urlJoin(getAbsoluteServerUrl(strapi.config), apiPrefix, 'connect', provider, 'callback');
+  };
 
   return {
     connect,

package/server/services/role.js

@@ -0,0 +1,177 @@
+'use strict';
+
+const _ = require('lodash');
+const { NotFoundError } = require('@strapi/utils').errors;
+const { getService } = require('../utils');
+
+module.exports = ({ strapi }) => ({
+  async createRole(params) {
+    if (!params.type) {
+      params.type = _.snakeCase(_.deburr(_.toLower(params.name)));
+    }
+
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .create({ data: _.omit(params, ['users', 'permissions']) });
+
+    const createPromises = _.flatMap(params.permissions, (type, typeName) => {
+      return _.flatMap(type.controllers, (controller, controllerName) => {
+        return _.reduce(
+          controller,
+          (acc, action, actionName) => {
+            const { enabled /* policy */ } = action;
+
+            if (enabled) {
+              const actionID = `${typeName}.${controllerName}.${actionName}`;
+
+              acc.push(
+                strapi
+                  .query('plugin::users-permissions.permission')
+                  .create({ data: { action: actionID, role: role.id } })
+              );
+            }
+
+            return acc;
+          },
+          []
+        );
+      });
+    });
+
+    await Promise.all(createPromises);
+  },
+
+  async getRole(roleID) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    const allActions = getService('users-permissions').getActions();
+
+    // Group by `type`.
+    role.permissions.forEach(permission => {
+      const [type, controller, action] = permission.action.split('.');
+
+      _.set(allActions, `${type}.controllers.${controller}.${action}`, {
+        enabled: true,
+        policy: '',
+      });
+    });
+
+    return {
+      ...role,
+      permissions: allActions,
+    };
+  },
+
+  async getRoles() {
+    const roles = await strapi.query('plugin::users-permissions.role').findMany({ sort: ['name'] });
+
+    for (const role of roles) {
+      role.nb_users = await strapi
+        .query('plugin::users-permissions.user')
+        .count({ where: { role: { id: role.id } } });
+    }
+
+    return roles;
+  },
+
+  async updateRole(roleID, data) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    await strapi.query('plugin::users-permissions.role').update({
+      where: { id: roleID },
+      data: _.pick(data, ['name', 'description']),
+    });
+
+    const { permissions } = data;
+
+    const newActions = _.flatMap(permissions, (type, typeName) => {
+      return _.flatMap(type.controllers, (controller, controllerName) => {
+        return _.reduce(
+          controller,
+          (acc, action, actionName) => {
+            const { enabled /* policy */ } = action;
+
+            if (enabled) {
+              acc.push(`${typeName}.${controllerName}.${actionName}`);
+            }
+
+            return acc;
+          },
+          []
+        );
+      });
+    });
+
+    const oldActions = role.permissions.map(({ action }) => action);
+
+    const toDelete = role.permissions.reduce((acc, permission) => {
+      if (!newActions.includes(permission.action)) {
+        acc.push(permission);
+      }
+      return acc;
+    }, []);
+
+    const toCreate = newActions
+      .filter(action => !oldActions.includes(action))
+      .map(action => ({ action, role: role.id }));
+
+    await Promise.all(
+      toDelete.map(permission =>
+        strapi
+          .query('plugin::users-permissions.permission')
+          .delete({ where: { id: permission.id } })
+      )
+    );
+
+    await Promise.all(
+      toCreate.map(permissionInfo =>
+        strapi.query('plugin::users-permissions.permission').create({ data: permissionInfo })
+      )
+    );
+  },
+
+  async deleteRole(roleID, publicRoleID) {
+    const role = await strapi
+      .query('plugin::users-permissions.role')
+      .findOne({ where: { id: roleID }, populate: ['users', 'permissions'] });
+
+    if (!role) {
+      throw new NotFoundError('Role not found');
+    }
+
+    // Move users to guest role.
+    await Promise.all(
+      role.users.map(user => {
+        return strapi.query('plugin::users-permissions.user').update({
+          where: { id: user.id },
+          data: { role: publicRoleID },
+        });
+      })
+    );
+
+    // Remove permissions related to this role.
+    // TODO: use delete many
+    await Promise.all(
+      role.permissions.map(permission => {
+        return strapi.query('plugin::users-permissions.permission').delete({
+          where: { id: permission.id },
+        });
+      })
+    );
+
+    // Delete the role.
+    await strapi.query('plugin::users-permissions.role').delete({ where: { id: roleID } });
+  },
+});

package/server/services/user.js

@@ -9,7 +9,7 @@
 const crypto = require('crypto');
 const bcrypt = require('bcryptjs');
 
-const { sanitizeEntity, getAbsoluteServerUrl } = require('@strapi/utils');
+const { getAbsoluteServerUrl, sanitize } = require('@strapi/utils');
 const { getService } = require('../utils');
 
 module.exports = ({ strapi }) => ({
@@ -114,29 +114,21 @@ module.exports = ({ strapi }) => ({
     return strapi.query('plugin::users-permissions.user').delete({ where: params });
   },
 
-  async removeAll(params) {
-    return strapi.query('plugin::users-permissions.user').delete({ where: params });
-  },
-
   validatePassword(password, hash) {
     return bcrypt.compare(password, hash);
   },
 
   async sendConfirmationEmail(user) {
     const userPermissionService = getService('users-permissions');
-    const pluginStore = await strapi.store({
-      environment: '',
-      type: 'plugin',
-      name: 'users-permissions',
-    });
+    const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });
+    const userSchema = strapi.getModel('plugin::users-permissions.user');
 
     const settings = await pluginStore
       .get({ key: 'email' })
       .then(storeEmail => storeEmail['email_confirmation'].options);
 
-    const userInfo = sanitizeEntity(user, {
-      model: strapi.getModel('plugin::users-permissions.user'),
-    });
+    // Sanitize the template's user information
+    const sanitizedUserInfo = await sanitize.sanitizers.defaultSanitizeOutput(userSchema, user);
 
     const confirmationToken = crypto.randomBytes(20).toString('hex');
 
@@ -144,11 +136,13 @@ module.exports = ({ strapi }) => ({
 
     settings.message = await userPermissionService.template(settings.message, {
       URL: `${getAbsoluteServerUrl(strapi.config)}/auth/email-confirmation`,
-      USER: userInfo,
+      USER: sanitizedUserInfo,
       CODE: confirmationToken,
     });
 
-    settings.object = await userPermissionService.template(settings.object, { USER: userInfo });
+    settings.object = await userPermissionService.template(settings.object, {
+      USER: sanitizedUserInfo,
+    });
 
     // Send an email to the user.
     await strapi